Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    153s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/08/2023, 17:09

General

  • Target

    1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe

  • Size

    1.4MB

  • MD5

    0ff650bb30c730e27ac477a02f725cb0

  • SHA1

    c749f6f44725f2f4905bef05a3f79096327b4e5a

  • SHA256

    1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236

  • SHA512

    e8dd1c1034f28bfa850b2511d93b129d79a3c7454b0b7c5f648b11cb7c9a61edb2eeaf789327be801f1b72791bd3bb035c83faaa9e4f78dad277df716a406261

  • SSDEEP

    24576:QyM8RUv0CPIUYl+YnKElET+wPXUdiJKxVz01fO/RF+6u5De08c3yYuh:XM9cCPIUOnKElETp0iJjMF+/i053Ru

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

stas

C2

77.91.124.82:19071

Attributes
  • auth_value

    db6d96c4eade05afc28c31d9ad73a73c

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe
    "C:\Users\Admin\AppData\Local\Temp\1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4929848.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4929848.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4435771.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4435771.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3174002.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3174002.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4118326.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4118326.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2088
            • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
              "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2080
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:2028
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2452
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:4976
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:N"
                    8⤵
                      PID:1060
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:R" /E
                      8⤵
                        PID:2596
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:4468
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:N"
                          8⤵
                            PID:216
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:R" /E
                            8⤵
                              PID:3400
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:1144
                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m8834172.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m8834172.exe
                        5⤵
                        • Executes dropped EXE
                        PID:1176
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6684726.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6684726.exe
                      4⤵
                      • Executes dropped EXE
                      PID:4400
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:2576
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:4788

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4929848.exe

                Filesize

                1.3MB

                MD5

                4642ab09cf7fbdfe60feaa10c7eec886

                SHA1

                8703f32040cece76721a67078c276505b1e4eede

                SHA256

                9d16655d78093c456041dea0a08daa7e9125435e96fde66c376adde94ce42af1

                SHA512

                05e5fa9042d6df02c977425b8acef85296a3973e756f95cc0922561911c23dd47f73244969bc6ac0e9ee3f69c81ddc0e3324c75bc7e5299344cc02bfc6e2461c

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4929848.exe

                Filesize

                1.3MB

                MD5

                4642ab09cf7fbdfe60feaa10c7eec886

                SHA1

                8703f32040cece76721a67078c276505b1e4eede

                SHA256

                9d16655d78093c456041dea0a08daa7e9125435e96fde66c376adde94ce42af1

                SHA512

                05e5fa9042d6df02c977425b8acef85296a3973e756f95cc0922561911c23dd47f73244969bc6ac0e9ee3f69c81ddc0e3324c75bc7e5299344cc02bfc6e2461c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4435771.exe

                Filesize

                475KB

                MD5

                a9e382aa9b0caf45273812d10f8b5b20

                SHA1

                bab4298edac53909107d476e24afa28281c36713

                SHA256

                6be9d079cf1fc0dc3627e4e8527b6b6dd621d233b8c4a54718fd427ce49a4b6c

                SHA512

                cf3ff22ce59369c5cc03867fbf7edda5ba3f43828b1c6a47cb01951382563737aeddbd98837811ccc74d7e69965d7290d270022950d15eceea25454cd4e60549

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4435771.exe

                Filesize

                475KB

                MD5

                a9e382aa9b0caf45273812d10f8b5b20

                SHA1

                bab4298edac53909107d476e24afa28281c36713

                SHA256

                6be9d079cf1fc0dc3627e4e8527b6b6dd621d233b8c4a54718fd427ce49a4b6c

                SHA512

                cf3ff22ce59369c5cc03867fbf7edda5ba3f43828b1c6a47cb01951382563737aeddbd98837811ccc74d7e69965d7290d270022950d15eceea25454cd4e60549

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6684726.exe

                Filesize

                174KB

                MD5

                ccd4350d31f8788aa1affc94f84a1fe1

                SHA1

                24bcb2544beffd0f54a4e8e058ad810aabef2ad0

                SHA256

                16e749fc4239b60595238d39d8a4e9cb832b055ea5a6a8be5ed0737ee8216121

                SHA512

                8aaf767f12469e0cd926be0c21cae652a4b5448c10bbdb3b8d6665d51f7c793187860c35ec76024c60b02251421e3d5ad4b545c1df0e7f065385760da5032522

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6684726.exe

                Filesize

                174KB

                MD5

                ccd4350d31f8788aa1affc94f84a1fe1

                SHA1

                24bcb2544beffd0f54a4e8e058ad810aabef2ad0

                SHA256

                16e749fc4239b60595238d39d8a4e9cb832b055ea5a6a8be5ed0737ee8216121

                SHA512

                8aaf767f12469e0cd926be0c21cae652a4b5448c10bbdb3b8d6665d51f7c793187860c35ec76024c60b02251421e3d5ad4b545c1df0e7f065385760da5032522

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3174002.exe

                Filesize

                319KB

                MD5

                376355d2b2ab967c1c9cba4ba49d7a87

                SHA1

                5e7b6d8dec24c881080719633f738f723e11c6a2

                SHA256

                59b6dc2dac101d277630a50b2d4eb745979c1531b7173b3bbd3a8f9defc772d9

                SHA512

                75405625d1553d01c7f9f8d1b1218f37f6b83b5eaa00d850c04f02c225a9bb99cfbf313c1559c97bf97c08f6f4245199af80413d81a4c76ea2e429c71e0654f1

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3174002.exe

                Filesize

                319KB

                MD5

                376355d2b2ab967c1c9cba4ba49d7a87

                SHA1

                5e7b6d8dec24c881080719633f738f723e11c6a2

                SHA256

                59b6dc2dac101d277630a50b2d4eb745979c1531b7173b3bbd3a8f9defc772d9

                SHA512

                75405625d1553d01c7f9f8d1b1218f37f6b83b5eaa00d850c04f02c225a9bb99cfbf313c1559c97bf97c08f6f4245199af80413d81a4c76ea2e429c71e0654f1

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4118326.exe

                Filesize

                324KB

                MD5

                2f03c86a61ca5d85e08b6ca71b9ff42f

                SHA1

                47eca57f9899382e8806257baee446b7b5e2264d

                SHA256

                3181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241

                SHA512

                963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4118326.exe

                Filesize

                324KB

                MD5

                2f03c86a61ca5d85e08b6ca71b9ff42f

                SHA1

                47eca57f9899382e8806257baee446b7b5e2264d

                SHA256

                3181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241

                SHA512

                963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m8834172.exe

                Filesize

                140KB

                MD5

                9da8bd3422fb22f0fc285818d8c3f15c

                SHA1

                169c8ad53720308177bd2ab23c80b9c5bb486810

                SHA256

                29a8d6f983254091d51ae0c5828b267683f0b3618ea16dfc7765be3a4f9bb9dd

                SHA512

                98305c743dd6f62a8660ade2d44dc0a33d09c58599488fa50c80260c55fd2e455ed52adb39c5bc84189b52b319dc5377c52d14846957a5cf0c4a6ae45cbbf45f

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m8834172.exe

                Filesize

                140KB

                MD5

                9da8bd3422fb22f0fc285818d8c3f15c

                SHA1

                169c8ad53720308177bd2ab23c80b9c5bb486810

                SHA256

                29a8d6f983254091d51ae0c5828b267683f0b3618ea16dfc7765be3a4f9bb9dd

                SHA512

                98305c743dd6f62a8660ade2d44dc0a33d09c58599488fa50c80260c55fd2e455ed52adb39c5bc84189b52b319dc5377c52d14846957a5cf0c4a6ae45cbbf45f

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                2f03c86a61ca5d85e08b6ca71b9ff42f

                SHA1

                47eca57f9899382e8806257baee446b7b5e2264d

                SHA256

                3181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241

                SHA512

                963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                2f03c86a61ca5d85e08b6ca71b9ff42f

                SHA1

                47eca57f9899382e8806257baee446b7b5e2264d

                SHA256

                3181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241

                SHA512

                963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                2f03c86a61ca5d85e08b6ca71b9ff42f

                SHA1

                47eca57f9899382e8806257baee446b7b5e2264d

                SHA256

                3181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241

                SHA512

                963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                2f03c86a61ca5d85e08b6ca71b9ff42f

                SHA1

                47eca57f9899382e8806257baee446b7b5e2264d

                SHA256

                3181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241

                SHA512

                963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                2f03c86a61ca5d85e08b6ca71b9ff42f

                SHA1

                47eca57f9899382e8806257baee446b7b5e2264d

                SHA256

                3181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241

                SHA512

                963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • memory/4400-40-0x00000000006B0000-0x00000000006E0000-memory.dmp

                Filesize

                192KB

              • memory/4400-47-0x000000000A5E0000-0x000000000A62B000-memory.dmp

                Filesize

                300KB

              • memory/4400-46-0x000000000A450000-0x000000000A48E000-memory.dmp

                Filesize

                248KB

              • memory/4400-49-0x0000000072420000-0x0000000072B0E000-memory.dmp

                Filesize

                6.9MB

              • memory/4400-45-0x000000000A3F0000-0x000000000A402000-memory.dmp

                Filesize

                72KB

              • memory/4400-44-0x000000000A4D0000-0x000000000A5DA000-memory.dmp

                Filesize

                1.0MB

              • memory/4400-43-0x000000000A9D0000-0x000000000AFD6000-memory.dmp

                Filesize

                6.0MB

              • memory/4400-42-0x0000000000D60000-0x0000000000D66000-memory.dmp

                Filesize

                24KB

              • memory/4400-41-0x0000000072420000-0x0000000072B0E000-memory.dmp

                Filesize

                6.9MB